The AADInternals PowerShell Module utilises several internal features of Azure Active Directory, Office 365, and related admin tools.
AADInternals allows you to export ADFS certificates, Azure AD Connect passwords, and modify numerous Azure AD / Office 365 settings not otherwise possible.
DISCLAIMER: Functionality provided through this module are not supported by Microsoft and thus should not be used in a production environment. Use on your own risk!
License: unknown
Published: over 1 year ago
Licenses
No license compliance issues
Secrets
No sensitive information found
Vulnerabilities
No known vulnerabilities detected
Hardening
1 baseline mitigations missing
Tampering
No evidence of software tampering
Malware
2 suspicious components found
INCIDENTS FOR THIS VERSION: 6 months ago Reported By: ReversingLabs (Automated) Learn more about
malware detection
List of software behaviors discovered with static code analysis.
Tampers with Active Directory settings. 2 settings
Prevalence in PowerShell Gallery community Behavior uncommon for this community (Uncommon) Gets or sets the security protocol used by the ServicePoint objects. 1 settings
Prevalence in PowerShell Gallery community Behavior often found in this community (Common) 1.23k packages
in community
Retrieves the name of the user associated with the process. 1 search
Prevalence in PowerShell Gallery community Behavior often found in this community (Common) 1.59k packages
in community
Loads additional snap-ins or modules to the current session. 1 payload
Prevalence in PowerShell Gallery community Behavior often found in this community (Common) 6.01k packages
in community
Imports values from .PSD1 file. 1 file
Prevalence in PowerShell Gallery community Behavior uncommon for this community (Uncommon) Interacts with Microsoft .NET Framework code, types and assemblies. 51 execution
Prevalence in PowerShell Gallery community Behavior often found in this community (Common) 15.62k packages
in community
Executes a file. 2 execution
Prevalence in PowerShell Gallery community Behavior often found in this community (Common) 3.63k packages
in community
Evaluates code dynamically. 8 execution
Prevalence in PowerShell Gallery community Behavior often found in this community (Common) 5.64k packages
in community
Creates and interacts with additional .NET objects. 5 execution
Prevalence in PowerShell Gallery community Behavior often found in this community (Common) 3.27k packages
in community
Uses PowerSploit/Empire command to return the domain object for the current (or specified) domain. 1 search
Prevalence in PowerShell Gallery community Behavior commonly used by malicious software (Important) Behavior uncommon for this community (Uncommon)